Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

platform/surface: Split memcpy() of struct ssam_event flexible array

To work around a misbehavior of the compiler's ability to see into
composite flexible array structs (as detailed in the coming memcpy()
hardening series[1]), split the memcpy() of the header and the payload
so no false positive run-time overflow warning will be generated.

[1] https://lore.kernel.org/linux-hardening/20220901065914.1417829-2-keescook@chromium.org

Cc: Maximilian Luz <luzmaximilian@gmail.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Mark Gross <markgross@kernel.org>
Cc: platform-driver-x86@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
Link: https://lore.kernel.org/r/20220927004011.1942739-1-keescook@chromium.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>

authored by

Kees Cook and committed by
Hans de Goede
a776bf77 d443fcad

+2 -1
+2 -1
drivers/platform/surface/surface_acpi_notify.c
··· 355 355 INIT_DELAYED_WORK(&work->work, san_evt_bat_workfn); 356 356 work->dev = d->dev; 357 357 358 - memcpy(&work->event, event, sizeof(struct ssam_event) + event->length); 358 + work->event = *event; 359 + memcpy(work->event.data, event->data, event->length); 359 360 360 361 queue_delayed_work(san_wq, &work->work, delay); 361 362 return SSAM_NOTIF_HANDLED;